Versioned security assessment

Report ID: SA-64CA8AF0

7/8/2026, 1:32:43 PM

notebooklm security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
notebooklm
Version
v4
Maintainer
ZhanlinCui
Source
github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/notebooklm
Coverage
15 Files scanned · 3,425 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

4 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Executable scripts use subprocess to set up an environment, install dependencies, install browser binaries, and run local scripts. Many Markdown detections are false positives, but the real code still stores session state and automates Google NotebookLM. Before publication, add explicit consent, URL validation, credential storage protections, and command allowlisting.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

15 Files scanned · 3,425 Lines analyzed

20 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 17 evidence locations

Filesystem access

May read or write local files.

Observed in 18 evidence locations

Env variables

May read values from the process environment.

Observed in 1 evidence location

External commands

May invoke commands or programs outside the Skill.

Observed in 78 evidence locations

Capability review items (16)
High
scripts/__init__.py:53
Python subprocess.run
subprocess.run(
On import, the package runs pip install against requirements.txt in the skill venv. Automatic dependency installation executes external package code and is a real supply-chain risk.
High
scripts/__init__.py:65
Python subprocess.run
subprocess.run(
On import, the package runs patchright browser installation through subprocess. This downloads and executes external setup commands as a side effect.
High
scripts/run.py:38
Python subprocess.run
result = subprocess.run([sys.executable, str(setup_script)])
run.py automatically invokes setup_environment.py when the venv is missing. That bootstrap path can install dependencies and browser binaries before the requested task runs.
High
scripts/run.py:91
Python subprocess.run
result = subprocess.run(cmd)
run.py executes a command built from the requested script name and arguments. It is scoped to the scripts directory, but there is no explicit allowlist before subprocess execution.
High
scripts/setup_environment.py:54
Python subprocess.run
subprocess.run(
The setup code upgrades pip through subprocess. This is intended setup behavior, but it executes package-management commands from skill code.
High
scripts/setup_environment.py:62
Python subprocess.run
result = subprocess.run(
The setup code installs requirements.txt through pip. Installing dependencies at runtime is a real external code execution and supply-chain risk.
High
scripts/setup_environment.py:75
Python subprocess.run
subprocess.run(
The setup code runs patchright install chrome through subprocess. This downloads browser binaries and extends the local execution surface.
High
scripts/setup_environment.py:132
Python subprocess.run
result = subprocess.run(cmd)
setup_environment.py can run a requested script through the venv Python. This is local command execution selected at runtime.
Medium
scripts/auth_manager.py:177
Python file write/append
with open(self.auth_info_file, 'w') as f:
The skill writes authentication metadata to a local auth_info file. The path is scoped, but it persists account-related state on disk.
Medium
scripts/auth_manager.py:204
Python shutil operations
shutil.rmtree(self.browser_state_dir)
clear_auth removes the browser state directory with shutil.rmtree. The path is scoped to skill data, but it is a destructive operation over stored session material.
Medium
scripts/cleanup_manager.py:173
Python shutil operations
shutil.rmtree(path)
The cleanup command deletes discovered data paths with shutil.rmtree. It is scoped and usually confirmed, but it can remove browser state, sessions, and library data.
Medium
scripts/notebook_manager.py:58
Python file write/append
with open(self.library_file, 'w') as f:
The library manager writes notebook URLs and metadata to disk. The file is scoped, but it persists user research context and access URLs locally.
Low
scripts/ask_question.py:80
Hardcoded URL
page.wait_for_url(re.compile(r"^https://notebooklm\.google\.com/"), timeout=10000)
The code validates that navigation reaches notebooklm.google.com during a query. This is intended, but it confirms external Google network access for user questions and notebooks.
Low
scripts/auth_manager.py:114
Hardcoded URL
page.goto("https://notebooklm.google.com", wait_until="domcontentloaded")
The authentication flow opens notebooklm.google.com in a persistent browser context. This is intended, but it sends browser traffic to an external Google service.
Low
scripts/auth_manager.py:129
Hardcoded URL
page.wait_for_url(re.compile(r"^https://notebooklm\.google\.com/"), timeout=timeout_ms)
The login flow waits for a NotebookLM URL after Google authentication. This confirms external network use tied to a user account.
Low
scripts/auth_manager.py:260
Hardcoded URL
page.goto("https://notebooklm.google.com", wait_until="domcontentloaded", timeout=30000)
The validation flow opens notebooklm.google.com to check stored authentication. This is intended, but it uses external network access with saved browser state.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (4)

RISK-001 High
scripts/auth_manager.py:160-165SKILL.md:193-198
Persistent Google Session Storage
The skill saves browser storage state for NotebookLM authentication and documents browser cookies and session data in local skill storage. This keeps Google session material on disk and increases exposure if local files are read.
auth_manager.py directly saves browser storage state to disk, and SKILL.md identifies browser cookies and session storage. This is clear persistent credential-adjacent material.
RISK-002 High
scripts/ask_question.py:40-47scripts/ask_question.py:75-80scripts/notebook_manager.py:63-99
Unvalidated Notebook URL Opened With Authenticated Browser
The question interface accepts a notebook URL and opens it in the browser before the NotebookLM domain wait succeeds. A malicious or mistaken URL can load in an authenticated browser profile before validation fails.
The URL is supplied by arguments or library metadata and page.goto runs before domain enforcement. The risk is bounded by browser origin controls but still exposes the authenticated browser session to arbitrary navigation.
RISK-003 High
scripts/setup_environment.py:70-76SKILL.md:202-207scripts/ask_question.py:103-115
Stealth Browser Automation Against Google NotebookLM
The skill installs a browser for Patchright anti-detection use, configures stealth-related settings, and simulates human typing. This increases abuse and account-policy risk for an external Google service.
The comments and configuration explicitly reference anti-detection and stealth behavior, and ask_question.py uses human-like typing and delay logic. The intent is clear even though it supports the stated feature.
RISK-004 Medium
scripts/ask_question.py:29-37scripts/ask_question.py:165-167SKILL.md:128-141
Tool Output Can Steer Agent Follow-Up Behavior
The skill appends a strong follow-up instruction to NotebookLM answers and tells the agent to stop, analyze, and ask more questions before responding. NotebookLM answers originate from uploaded documents, so source content can influence agent control flow unless treated as untrusted.
The follow-up instruction is explicit in both code and skill instructions. I did not find a malicious prompt injection string, but the design creates a reliable path for untrusted source text to affect agent behavior.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Automatic subprocess setup and runtime script execution
    Ask before dependency or browser installation. Remove import-time setup and allowlist script names in run.py.
  2. FIX-002
    High
    Persistent Google browser session data on disk
    Use OS keychain or encrypted storage. Restrict file permissions and add clear cleanup controls.
  3. FIX-003
    High
    Notebook URLs are opened before strict domain validation
    Validate URLs before page.goto. Allow only https://notebooklm.google.com/notebook/ unless the user approves another target.
  4. FIX-004
    High
    Stealth and anti-detection browser automation
    Remove anti-detection behavior where possible. Disclose browser automation and avoid bypassing service automation checks.
  5. FIX-005
    Medium
    NotebookLM responses can influence agent follow-up behavior
    Treat NotebookLM answers as untrusted source content. Ensure tool output cannot override higher-priority instructions.
  6. FIX-006
    Medium
    Cleanup commands can delete local state
    Keep cleanup behind confirmation. Show exact paths before deletion and avoid force mode by default.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable